North Korean hackers deploy NSA-backed post-quantum encryption in malware campaigns

State-sponsored threat actors have stepped up their technical capabilities by adopting post-quantum encryption to secure malware delivery channels. According to a new threat analysis from Kaspersky, the notorious North Korean hacking collective known as Lazarus has integrated ML-KEM-1024 into an updated version of its LPEClient tool. This cryptographic algorithm, designated by the NSA as a standard for national security systems under CNSA 2.0, is designed specifically to resist decryption attempts from future quantum computers.

The campaign, tracked by researchers as Operation FlashHole, has targeted South Korean software, construction, and telecom equipment firms since at least July 2025. Investigations by Kaspersky and Check Point show that the group utilized fake GitHub Pages sites featuring AI-generated résumés and portfolios to initiate spear-phishing attacks. These initial access vectors ultimately leveraged vulnerabilities in local authentication and financial security software to inject malicious payloads into memory.

While the integration of post-quantum cryptography sounds an alarm for cybersecurity professionals, security analysts emphasize that the cryptographic layer protects network traffic rather than endpoint detection. The mechanism uses four ML-KEM-1024 key exchanges to establish a secure channel for downloading additional payloads, effectively hiding communication traffic from immediate interception. This rapid adoption highlights how advanced threat groups leverage cutting-edge cryptographic standards nearly as fast as legitimate enterprises roll out defensive implementations.

Security agencies and independent researchers continue to monitor the evolution of Lazarus tactics, noting a clear convergence of generative AI for social engineering and high-grade cryptographic protocols for command-and-control infrastructure. As enterprises worldwide transition their systems to post-quantum standards, the malicious use of these same algorithms underscores an urgent need for robust, behavior-based endpoint defense strategies that look beyond simple traffic encryption.